CODEOWNERS is only enforced when required approvals is above zero #99

closed cmc opened this on 2026-09-03 05:13 UTC · bug mr security · milestone v1.9.0

Discussion

cmc 2026-09-03 05:13 UTC

internal/control/mr.go:1152 returns early when RequireApprovals == 0; the CODEOWNERS block sits inside that branch (:1156-1239). A repository with a CODEOWNERS file and default settings gets no owner gating.

Remedy: evaluate CODEOWNERS whenever the file exists, independent of the approval count.

closed by commit eee4509235 by cmc: mr: CODEOWNERS gates on its own, not only under require-approvals

2026-09-03 17:10 UTC

referenced in commit 1f8076c655 by cmc: merge gates: CODEOWNERS is a setting, not a file that happens to exist

2026-09-04 14:25 UTC